CVE-2026-91008 Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel
Unauthenticated attackers can retrieve attendee PII via booking references in Event Booking Manager for WooCommerce when using native checkout.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91008?
CVE-2026-91008 is a low-severity missing authorization vulnerability in Unknown Event Booking Manager for WooCommerce, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.
Weakness: CWE-639
Which versions are affected by CVE-2026-91008?
How do I fix CVE-2026-91008?
No fix has been published for CVE-2026-91008 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-91008 being exploited?
There is no known exploitation of CVE-2026-91008 in the wild and no public exploit code.
Sources
Also known as GHSA-vc5f-85m8-x67v.